Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
42
Disclosed reports
13
Subdomains
17,149
Vendor on CyberSIXT
Paypal (21 CVEs, 0 exploited)

Most upvoted reports13

All reports
Most upvoted reports of PayPal
ReportWeaknessDisclosedBountyVotes
Bypass for #488147 enables stored XSS on https://paypal.com/signin againAnalysed#510152Injection and Smuggling2019-08-07$20,0002,687
Token leak in security challenge flow allows retrieving victim's PayPal email and plain text passwordAnalysed#739737Authentication2020-01-08$15,3001,409
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#925585Command and Code Injection2021-02-09$30,000946
DoS on PayPal via web cache poisoningAnalysed#622122Denial of Service2019-10-23$9,700851
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/usersAnalysed#415081Insecure Direct Object Reference2019-07-30$10,500797
Stored XSS on https://paypal.com/signin via cache poisoningAnalysed#488147Injection and Smuggling2019-08-07$18,900685
[PayPal Android] Remote theft of user session using push_notification_webview deeplinkAnalysed#424443Open Redirect2019-02-07–188
[Venmo Android] Remote theft of user sessionAnalysed#401940Open Redirect2019-02-07–151
Reflected XSS at https://www.paypal.com/ppcreditapply/da/usAnalysed#753835Cross-site Scripting2020-05-19–137
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)Analysed#425200Cross-site Scripting2018-11-06–100

Subdomains17,149

Subdomains of PayPal
NameScopeFirst seen
when-was-http-1.0-support-discontinued-on-www.paypal.comIn scope2026-11-14
0cd20b6fe61233e4a24bf70f30c9ba46.paypal.comIn scope2026-11-14
0f9f263.paypal.comIn scope2026-11-14
10086.paypal.comIn scope2026-11-14
16695532.paypal.comIn scope2026-11-14
1us58sf5m40.paypal.comIn scope2026-11-14
1vdycpj2.paypal.comIn scope2026-11-14
20.paypal.comIn scope2026-11-14
20www.paypal.comIn scope2026-11-14
22c4b9971d8140.paypal.comIn scope2026-11-14
24-reservedip.paypal.comIn scope2026-11-14
64.4.247.24-reservedip.paypal.comIn scope2026-11-14
25-reservedip.paypal.comIn scope2026-11-14
247.25-reservedip.paypal.comIn scope2026-11-14
64.4.247.25-reservedip.paypal.comIn scope2026-11-14
250awww.paypal.comIn scope2026-11-14
2525252furi.paypal.comIn scope2026-11-14
25252fwww.paypal.comIn scope2026-11-14
252fbusiness.paypal.comIn scope2026-11-14
252fwww.paypal.comIn scope2026-11-14
26-reservedip.paypal.comIn scope2026-11-14
64.4.247.26-reservedip.paypal.comIn scope2026-11-14
27-reservedip.paypal.comIn scope2026-11-14
64.4.247.27-reservedip.paypal.comIn scope2026-11-14
28-reservedip.paypal.comIn scope2026-11-14
64.4.247.28-reservedip.paypal.comIn scope2026-11-14
29-reservedip.paypal.comIn scope2026-11-14
64.4.247.29-reservedip.paypal.comIn scope2026-11-14
2fwww.paypal.comIn scope2026-11-14
30-reservedip.paypal.comIn scope2026-11-14
64.4.247.30-reservedip.paypal.comIn scope2026-11-14
31-reservedip.paypal.comIn scope2026-11-14
64.4.247.31-reservedip.paypal.comIn scope2026-11-14
312dclju2s.paypal.comIn scope2026-11-14
32q86nf9.paypal.comIn scope2026-11-14
3i7978v7.paypal.comIn scope2026-11-14
3pimages.paypal.comIn scope2026-11-14
3t.paypal.comIn scope2026-11-14
api.3t.paypal.comapiIn scope2026-11-14
430-9160.paypal.comIn scope2026-11-14
4b2203860e520112.paypal.comIn scope2026-11-14
4u.paypal.comIn scope2026-11-14
5dp5460xi.paypal.comIn scope2026-11-14
609k83.paypal.comIn scope2026-11-14
7261e6ef7227.paypal.comIn scope2026-11-14
7q9x3.paypal.comIn scope2026-11-14
80y0wez.paypal.comIn scope2026-11-14
8bdo2fc7maf.paypal.comIn scope2026-11-14
8mu69.paypal.comIn scope2026-11-14
99.paypal.comIn scope2026-11-14
a.paypal.comIn scope2026-11-14
a22026d69264139.paypal.comIn scope2026-11-14
a55a7c98d133.paypal.comIn scope2026-11-14
aa.paypal.comIn scope2026-11-14
api.3t.aa.paypal.comapiIn scope2026-11-14
about.paypal.comIn scope2026-11-14
access.paypal.comvpnIn scope2026-11-14
cdn.account.paypal.comIn scope2026-11-14
data.account.paypal.comIn scope2026-11-14
accounts.paypal.comIn scope2026-11-14
active-api-m.paypal.comapiIn scope2026-11-14
active-api-s.paypal.comapiIn scope2026-11-14
active-c.paypal.comIn scope2026-11-14
active-history.paypal.comIn scope2026-11-14
active-mobile.paypal.comIn scope2026-11-14
active-mobileclient.paypal.comIn scope2026-11-14
active-pics.paypal.comIn scope2026-11-14
active-www.paypal.comIn scope2026-11-14
activemobile.paypal.comIn scope2026-11-14
ad.paypal.comIn scope2026-11-14
adjvendor.paypal.comIn scope2026-11-14
admin.paypal.comadminIn scope2026-11-14
admin-business.paypal.comadminIn scope2026-11-14
admin-settlementpreferences.paypal.comadminIn scope2026-11-14
adnormserv.paypal.comIn scope2026-11-14
adnormserv-dft.paypal.comIn scope2026-11-14
adnormserv-phx.paypal.comIn scope2026-11-14
adnormserv-slc-a.paypal.comIn scope2026-11-14
adnormserv-slc-b.paypal.comIn scope2026-11-14
adnormservslc-a.paypal.comIn scope2026-11-14
adnormservslc-b.paypal.comIn scope2026-11-14
advertising.paypal.comIn scope2026-11-14
agw.paypal.comIn scope2026-11-14
airflow-ccg24-host.paypal.comtoolsIn scope2026-11-14
aktest.paypal.comIn scope2026-11-14
alp.paypal.comIn scope2026-11-14
am-vip.paypal.comIn scope2026-11-14
amex-xml-vpn-live.paypal.comvpnIn scope2026-11-14
amex_signing_cert.paypal.comIn scope2026-11-14
p2pmobile.android.paypal.comIn scope2026-11-14
announcements.paypal.comIn scope2026-11-14
aobama.paypal.comIn scope2026-11-14
aoriginspring.paypal.comIn scope2026-11-14
testing.lb-syf-testbed.region-stage.bucky.aoriginspring.paypal.comstaging, testIn scope2026-11-14
apex-test-vip.paypal.comtestIn scope2026-11-14
api.paypal.comapiIn scope2026-11-14
api-3t.paypal.comapiIn scope2026-11-14
api-3t-aa-silo-phx.paypal.comapiIn scope2026-11-14
api-3t-raz01-silo.paypal.comapiIn scope2026-11-14
api-3t-silo-phx.paypal.comapiIn scope2026-11-14

17,017 names are covered by the program's own scope; 3 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.